Red Hat Bugzilla – Bug 456637
phpMyAdmin: Cross-site Framing; XSS in setup.php (PMASA-2008-6 - CVE-2008-3456, CVE-2008-3457)
Last modified: 2008-08-05 02:46:05 EDT
Description of problem:
phpMyAdmin < 2.11.8-rc1 contains two not yet clearly documented security bugs:
"Welcome to phpMyAdmin 2.11.8-rc1, the first release candidate containing normal
bug fixes and two security fixes. The security announcement will follow [...]"
Additional info (http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0):
Fixes for 2.11.8.x:
- patch #1987593 [interface] Table list pagination in navi
- bug #1989081 [profiling] Profiling causes query to be executed again
(really causes a problem in case of INSERT/UPDATE)
- bug #1990342 [import] SQL file import very slow on Windows
- bug [XHTML] problem with tabindex and radio fields
- bug #1971221 [interface] tabindex not set correctly
- bug [views] VIEW name created via the GUI was not protected
- bug #1989813 [interface] Deleting multiple views (space in name)
- bug #1992628 [parser] SQL parser removes essential space
- bug #1989281 [export] CSV for MS Excel incorrect escaping of
- bug #1959855 [interface] Font size option problem when no
- bug #1982489 [relation] Relationship view should check for changes
- bug [history] Do not save too big queries in history
- [security] Do not show version info on login screen
- bug #2018595 [import] Potential data loss on import resubmit
- patch #2020630 [export] Safari and timedate
- bug #2022182 [import, export] Import/Export fails because of
- [security] protection against cross-frame scripting and
new directive AllowThirdPartyFraming
- [security] possible XSS during setup
- [interface] revert language changing problem introduced
phpMyAdmin-2.11.8-0.1.fc9 has been submitted as an update for Fedora 9
phpMyAdmin-2.11.8-0.1.fc8 has been submitted as an update for Fedora 8
Maybe let us wait for 2.11.8 final which already should be around the corner as
per upstream now.
Robert, if you prefer to wait, just revoke update request or change type to
testing and update it with new build once upstream final is out.
phpMyAdmin-2.11.8-1.fc8 has been submitted as an update for Fedora 8
phpMyAdmin-2.11.8-1.fc9 has been submitted as an update for Fedora 9
Okay, here we can go now ;-)
Bah! phpMyAdmin 2.11.8 is already obsoleted by 22.214.171.124 which is currently
phpMyAdmin-126.96.36.199-1.fc8 has been submitted as an update for Fedora 8
phpMyAdmin-188.8.131.52-1.fc9 has been submitted as an update for Fedora 9
phpMyAdmin-184.108.40.206-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
phpMyAdmin-220.127.116.11-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from
using frames that point to pages in other domains, which makes it
easier for remote attackers to conduct spoofing or phishing activities
via a cross-site framing attack.
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin
before 2.11.8 allows user-assisted remote attackers to inject
arbitrary web script or HTML via crafted setup arguments. NOTE: this
issue can only be exploited in limited scenarios in which the attacker
must be able to modify config/config.inc.php.
Updates went to stable as: